The system described in Japanese Patent Laid-Open Publication No. H08-263575 (JP-A-8-263575) is one known example of a prior-art anonymous decryption system of this type. The anonymous decryption system that is described in this document is based on Mix-Net method, and as shown in FIG. 10, is made up from: a plurality of decryption shuffle centers 100-1 to 100-n, and electronic bulletin board system 200 which is arranged on a network such as the Internet and which can be accessed from the outside.
Each of decryption shuffle centers 100-1 to 100-n is provided with partial decryption means 101, shuffling means 102, and certification means 103. In addition, each of decryption shuffle centers 100-1 to 100-n holds a public key for encryption which is generated in accordance with separately determined security parameters and a decryption key for decryption. The anonymous decryption system that is shown in FIG. 10 employs a key which is combined from the public key of each of decryption shuffle centers 100-1 to 100-n as an public encryption key for encrypting data.
When a plurality of senders (not shown in the figure) write encrypted data which have been encrypted using the public encryption key to electronic bulletin board system 200, decryption shuffle center 100-1, which is first in processing priority, enters the above-described encrypted data that have been written by the plurality of senders as encrypted data list 201 and carries out the following processing.
Decryption shuffle center 100-1 first uses partial decryption means 101 to subject encrypted data list 201 to a partial decryption process. At this time, partial decryption means 101 uses the decryption key that is held by decryption shuffle center 100-1. Decryption shuffle center 100-1 next uses shuffling means 102 to subject the encrypted data list that has undergone partial decryption to an order-switching process.
Decryption shuffle center 100-1 then uses certification means 103 to generate certification data for certifying that the partial decryption process and the order-switching process have been performed correctly. Finally, decryption shuffle center 100-1 writes data 202-1 which includes the encrypted data list (i.e., data list) which has undergone the partial decryption process and the order-switching process and certification data to electronic bulletin board system 200.
When data 202-1 have been written to electronic bulletin board system 200, decryption shuffle center 100-2, which is second in processing priority, performs the same processes on the data list in data 202-1 as the processes carried out by decryption shuffle center 100-1 and writes data 200-2 which includes the data list and certification data to electronic bulletin board system 200.
The same operation is performed successively until the last decryption shuffle center 100-n, and data 203 that includes the decryption result list and certification data are written to electronic bulletin board system 200.
The above-described anonymous decryption system of the prior art uses an electronic bulletin board system and therefore entails several problems as follows. In order to allow each decryption shuffle center to perform the partial decryption process and order-switching process as well as to allow each sender to verify the certification data, each decryption shuffle center and each sender must be able to freely access and read the electronic bulletin board system. Further, in order to prevent illegitimate actions, the writing of data to the electronic bulletin board system must be restricted to authorized data from the authorized senders and the decryption shuffle center. An anonymous decryption system of the prior art must therefore enable each decryption shuffle center and each sender to freely read an electronic bulletin board, and moreover, must restrict the writing of data to an electronic bulletin board to only authorized data from authorized senders and decryption shuffle centers, and these requirements complicate the management.
In addition, from the standpoint of protecting anonymity, in actual operations, each of the decryption shuffle centers which make up an anonymous decryption system are each preferably operated by separate organizations. Operating the system by separate organizations, however, raises the danger of complicating the task of making initial settings which determine the various important parameters (such as keys used by users for encrypting messages) which are necessary for the system. Consequently, there is the danger that the details of determining the important parameters will not be clear, and as a result, there is a potential for problems in the normal operation of the system.
It is therefore an object of the present invention to both eliminate the need for complicated management procedures and to make the initial settings task easier and more reliable.